sks,nixos/sks: Various minor improvements
Module:
- Add a webroot option (serve a website by default, makes the setup easier)
- Explicitly set a group (instead of using 65534/nogroup)
- Move pkgs.sks from environment.systemPackages to the "sks" user and add pkgs.db
Package:
- Adapt the output of "sks version" to NixOS
- Copy the example webpages to $webSamples
That way the built-in web server is usable by default but users can use
$HOME/web directly (instead of having to use a symlink), if they want to
customize the webpage.
Without a group the gid will default to 65534 (2^16 - 2) which maps to
"nogroup". IMO it makes more sense to explicitly set a valid group.
Adding pkgs.sks to environment.systemPackages is not required (IIRC we
want to avoid bloating environment.systemPackages). Instead it seems
like a better idea to make the relevant binaries available to the user
sks and enable useDefaultShell so that "su -l sks" can be used for
manual interaction (that way the files will always have the correct
owner).
This package was marked as broken since
9cb0b49673.
Reason: The package is outdated and keeping up with the beta releases
isn't really worth it (there are regular stable releases).
Thought this could be useful for others as well. Unfortunately it will
also override the UI language.
Example usage:
environment.systemPackages = with pkgs; [
(signal-desktop.override {
spellcheckerLanguage = "de_DE";
})
];
Upstream changelog:
- SECURITY UPDATE: In previous versions of libfuse it was possible to
for unprivileged users to specify the allow_other option even when
this was forbidden in /etc/fuse.conf. The vulnerability is present
only on systems where SELinux is active (including in permissive
mode).
- libfuse no longer segfaults when fuse_interrupted() is called outside
the event loop.
- The fusermount binary has been hardened in several ways to reduce
potential attack surface. Most importantly, mountpoints and mount
options must now match a hard-coded whitelist. It is expected that
this whitelist covers all regular use-cases.
- Fixed rename deadlock on FreeBSD.
Upstream changelog:
- SECURITY UPDATE: In previous versions of libfuse it was possible to
for unprivileged users to specify the allow_other option even when
this was forbidden in /etc/fuse.conf. The vulnerability is present
only on systems where SELinux is active (including in permissive
mode).
- The fusermount binary has been hardened in several ways to reduce
potential attack surface. Most importantly, mountpoints and mount
options must now match a hard-coded whitelist. It is expected that
this whitelist covers all regular use-cases.
- Added a test of seekdir to test_syscalls.
- Fixed readdir bug when non-zero offsets are given to filler and the
filesystem client, after reading a whole directory, re-reads it from a
non-zero offset e. g. by calling seekdir followed by readdir.
tdesktopPackages.preview: 1.3.7 -> 1.3.10
Without the patch the build will fail with the following error:
[ 15%] Building CXX object CMakeFiles/lib_export.dir/build/tdesktop/Telegram/SourceFiles/export/export_api_wrap.o
/build/tdesktop/Telegram/SourceFiles/export/export_api_wrap.cpp: In lambda function:
/build/tdesktop/Telegram/SourceFiles/export/export_api_wrap.cpp:712:56: internal compiler error: Segmentation fault
if constexpr (MTPDphotos_photos::Is<decltype(data)>()) {
^
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://gcc.gnu.org/bugs/> for instructions.
make[2]: *** [CMakeFiles/lib_export.dir/build.make:77: CMakeFiles/lib_export.dir/build/tdesktop/Telegram/SourceFiles/export/export_api_wrap.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:1101: CMakeFiles/lib_export.dir/all] Error 2
make: *** [Makefile:84: all] Error 2
Michael Weiss